CVE-2026-107392

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

Carried by container images the latest versions of 2 of 18,108 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
music-metadatanpm	7.11.3, 11.10.3	11.15.0	2

2 by stars

Chart

Latest

Affected images

Radar Score

mstreamnicholaswilde

1 of the 1 container images this version deploys carry CVE-2026-107392.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/mstream :version-v5.2.5	22c012bcc43c	music-metadata@7.11.3	11.15.0

5,894

1 of the 5 container images this version deploys carry CVE-2026-107392.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	music-metadata@11.10.3	11.15.0

4,752

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
evoapicloud/evolution-api :latest	966625532d90	music-metadata@11.10.3	11.15.0	1
ghcr.io/linuxserver/mstream :version-v5.2.5	22c012bcc43c	music-metadata@7.11.3	11.15.0	1